It’s unacceptable to ship this kind of security flaw even for a half baked internal proof of concept.